A monitor system is known that monitors a node apparatus such as a server, a storage, a network apparatus, detects phenomenon (hereinafter referred to as “event”) such as failure or status change that has occurred in a node apparatus of a monitor target, and analyzes a root cause of the detected event (for example, see PTL 1).
The monitor system stores multiple rules indicating, for example, corresponding relationship between one or more condition events corresponding to one or more events related to any one of multiple node apparatuses and a conclusion which is a cause in a case where the one or more events occur, and calculates a certainty indicating the certainty that each conclusion is the cause on the basis of presence/absence of detection of the rule and the condition event. For example, a certainty regarding a certain conclusion is a ratio of the number of condition events which are associated with the conclusion and which are detected by the monitor system with respect to the total number of condition events associated with the condition. The monitor system displays a result of the cause analysis including the certainty calculated. The administrator can look up the result of the cause analysis displayed on the monitor system, and can estimate the root cause.